PyPI: nltk
CVE-2026-80206
Safety vulnerability ID: SFTY-20260908-92033
Affected versions of the NLTK package are vulnerable to Regular Expression Denial of Service (ReDoS) due to unvalidated user-supplied regular expressions. The `tgrep` module's `_tgrep_node_action()` function compiles user-provided regex literals without validation or execution time constraints, leading to potential catastrophic backtracking. An attacker can exploit this by submitting a specially crafted regex pattern via the `tgrep` API, causing the Python process to hang indefinitely and resulting in a denial-of-service attack.
Overview
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
Advisory
nltk – Regular Expression Denial of Service (ReDoS)
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260908-92033/CVE-2026-80206
- https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7
- https://nvd.nist.gov/vuln/detail/CVE-2026-80206
- https://github.com/nltk/nltk/commit/0072ea2fb8be22e038a36e887b7061bb6b9339d9
- https://github.com/nltk/nltk/releases/tag/v3.10.3
- https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3751.yaml
- https://www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep
- https://github.com/advisories/GHSA-w3v8-gmh9-3wv7
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more